Add skill-invocation counting with Canvas Authoring 0.1.2

.github/plugin/marketplace.json

@@ -23,7 +23,7 @@
     {
       "name": "canvas-authoring",
       "description": "Build canvas apps with the native create-canvas skill and a toolkit setup companion.",
-      "version": "0.1.1",
+      "version": "0.1.2",
       "source": "plugins/canvas-authoring"
     },
     {

docs/canvas-authoring/0.1.2/SHA256SUMS

@@ -0,0 +1,27 @@
+e4f0de3656e1835a295b9a0963b35bb87af4163adf113b4248ea1cce90125c5c  README.md
+2c4eb2635f0c3ef0f81a2b1e7b4650933759a0d66c53210af078c27e1967f51c  com.github.copilot/extensions/canvas-authoring/extension.mjs
+d9a85d9c233bca2c8287b29dc0db92c4aa245789b31d0f2ede249bd078a78cb1  plugin.json
+18f308efc70199eaf41fb6f52b85e5b5ceb21c790d91effa0c88f94dfb82d872  skills/create-canvas-app/SKILL.md
+b5824155c9558d115a16a503de581cc001194f8414057292ab5cc04e14792ea0  skills/create-canvas-app/references/toolkit.md
+d25deed12d803f6c973597348627b1939e2d19bbc28fda83c93ea0cde44702da  skills/create-canvas-app/references/toolkit/LICENSE
+40d66d89c564be6bcb3e6741deed224417d3bc051cd3585ec665aa7a2eeae6a8  skills/create-canvas-app/references/toolkit/README.md
+b22b317cd93b5fb40636fbaccba2750501faf41b54bcf9c6bb971c5355c9e23b  skills/create-canvas-app/references/toolkit/auth.md
+70d8d6683e31c01ce8538d339f676901ac1332710dc19ff8afbfa443b0ae399b  skills/create-canvas-app/references/toolkit/examples/README.md
+18ea90a17fb7d39104f343b3a53079dfed536bdd9a6dafc71321de5158be61bb  skills/create-canvas-app/references/toolkit/examples/custom-fetch-client.mjs
+3d81ea6de1551da83f008251f204e06e736e9655aed450765b4f416a834d1eb8  skills/create-canvas-app/references/toolkit/examples/resource-groups.mjs
+5809596d28119f393975235a44b5784d95a82354eb56d84c2adcbba0f2ab34ce  skills/create-canvas-app/references/toolkit/examples/run-read-only.mjs
+e9adf9797984f6b23f2f7b0807898a551f2ca5ab122f5f644033e705e2efa1cc  skills/create-canvas-app/references/toolkit/examples/sdk-client.mjs
+64a244c012e41bc8da6089575e1cf531d30a113ad931f464402ba02226c3465b  skills/create-canvas-app/references/toolkit/provenance.json
+90d339293305a4131381db2170bda0b68fd3dba63a78259f21d373b096bfae5e  skills/create-canvas-app/references/toolkit/quickstart.md
+721004c52d2ce05d5da548d98dbc581da2198840b4e481deed3b0ddad21aad8d  skills/create-canvas-app/scripts/setup-toolkit.mjs
+2e517e47f4f537dfa4362abe8dac4fe754dfd076459231526298997c3e592b2e  skills/create-canvas-app/templates/azure-resource-groups/README.md
+67451cd55721f065083817d8a6cf0e1068b54a828e000cf00627fe25fe44ca6f  skills/create-canvas-app/templates/azure-resource-groups/package.json
+3bcf34bcc5dd31561430a860e289e35a641d7e328e7cf20b08ee4fc819320c15  skills/create-canvas-app/templates/azure-resource-groups/scripts/check-entry.mjs
+94397d5f1426d39ba319d5f03dfd6c03b8c9e2837cb04438c897f687eeecdd9a  skills/create-canvas-app/templates/azure-resource-groups/scripts/smoke.mjs
+8ad79093b4bcc4aa319918ecd4c8258d729a791439bdd1e7c277458aee5763cd  skills/create-canvas-app/templates/azure-resource-groups/src/browser/app.css
+99943892a9a29ec75aed93150b208f9d1ff014d0d3649310158399c3043ee3e6  skills/create-canvas-app/templates/azure-resource-groups/src/browser/app.mjs
+25cef53f8e5218625b86507312b43942ad9332141037f21dbaa590cc783223e8  skills/create-canvas-app/templates/azure-resource-groups/src/browser/index.html
+16dfd1d2bd48e3563e84597337b97e87d6ed20960336ac7249fa131ed641dd54  skills/create-canvas-app/templates/azure-resource-groups/src/canvas.mjs
+62b66ccbf5d74cd8b59c53a3a5ba74772e58f51893a0199c92e36c05db127b12  skills/create-canvas-app/templates/azure-resource-groups/src/domain.mjs
+f8f66cbd63fa3a07427676085b64e2684f60398e1459e7a3927b2104d8fb8186  skills/create-canvas-app/templates/azure-resource-groups/src/fixture.mjs
+55e688f04faa2d6bf4587f6a5f9bdd445494c2e5b13495eef58ef2004497daa4  skills/create-canvas-app/templates/azure-resource-groups/tests/app.test.mjs

docs/release-process.md

@@ -74,6 +74,13 @@ verifier must check that the earlier product release is an ancestor, that
 the skill-only package tree and full checksum inventory match its tag, and
 that it has no extension or canvas. Its package root may be `plugins/<product>`
 with `plugin.json` directly in that directory rather than the canvas layout.
+Canvas Authoring's current full-file receipt lives outside the installable
+payload at `docs/canvas-authoring/<package-version>/SHA256SUMS`, selected from
+the package's marketplace version. Preserve the historical 0.1.1 receipt at
+`docs/canvas-authoring/SHA256SUMS` and verify it against its immutable tag.
+The authoring companion may include its reviewed canvas-less session telemetry
+provider under `com.github.copilot/extensions/canvas-authoring/`; this does not
+add a canvas or an `extensions` field to its root plugin manifest.
 For a subsequent combined canvas and skill-only patch release, all new
 source-qualified tags point to one later approved merge commit descending
 from the previous builder release. Verify the prior canvas and builder

plugins/canvas-authoring/README.md

@@ -1,83 +1,76 @@
 # Canvas authoring plugin
 
-Create a canvas app with the Microsoft Canvas Toolkit. This skill-only
-companion adds toolkit setup and a counter or read-only Azure resource-group
-starter to the host's native `create-canvas` workflow. Installing it does not
-open a canvas.
-
-## Requirements
-
-- A canvas-capable GitHub Copilot host with its installed `create-canvas` skill.
-  The plugin does not replace or install that host skill.
-- Node.js 22+ (24 recommended) and npm.
-- The exact `@microsoft/canvas-toolkit@0.1.0-preview.2` release exporting
-  `@microsoft/canvas-toolkit/build`, or an approved local
-  `.tgz` containing that API. Do not treat a missing `/build` export as success.
-- For live Azure reads: Azure CLI 2.61+ and permission to read the subscription.
+Create a canvas app with the Microsoft Canvas Toolkit. This **skill-only
+companion** gives the host's native `create-canvas` workflow toolkit setup
+and a counter or read-only Azure resource-group starter; installing it does
+not open a canvas.
 
 ## Install
 
-Version 0.1.1 is published at the immutable
-`canvas-authoring-v0-1-1-8af10f8` tag, and `canvas-authoring-latest` points to
-that release. Add the production marketplace and install the plugin:
+If your GitHub Copilot host shows the **awesome-copilot** marketplace, open
+**Customize → Plugins** and install **canvas-authoring**. Its
+[listed 0.1.1 package](https://github.com/microsoft/azure-dev-tools/tree/a6d394bbaa6fb1dc0151257a85cbac0de772b138/plugins/canvas-authoring)
+is a skill-only companion, not a canvas extension. If the marketplace is
+missing, add it first:
 
 ```sh
-copilot plugin marketplace add microsoft/azure-dev-tools
-copilot plugin install canvas-authoring@azure-dev-tools
+copilot plugin marketplace add github/awesome-copilot
+copilot plugin install canvas-authoring@awesome-copilot
 ```
 
-To install the exact tagged package:
-
-```sh
-git clone --depth 1 --branch canvas-authoring-v0-1-1-8af10f8 https://github.com/microsoft/azure-dev-tools.git canvas-authoring-plugin
-copilot --plugin-dir "./canvas-authoring-plugin/plugins/canvas-authoring"
-```
-
-To try another approved local export:
+For an approved local export, run:
 
 ```sh
 copilot --plugin-dir "<export-directory>/plugins/canvas-authoring"
 ```
 
-Use the **exported plugin**, not the source folder `build/canvas-authoring/`.
-This page describes the installed plugin; its bundled documentation links
-resolve after export. Installing it adds a skill, not a running canvas app.
+Install the exported plugin, not this source folder.
 
-## Create an app
+You need a canvas-capable Copilot host with the native `create-canvas` skill,
+Node.js 22+, and an available toolkit package; the Azure starter also needs
+Azure CLI and subscription read access. See [requirements](#requirements).
 
-Ask your agent:
+## Try it
 
-```text
-Build a read-only Azure canvas that lists resource groups.
-Use the native create-canvas skill and the create-canvas-app companion's
-Azure starter. Help me choose a compatible toolkit version.
-```
-
-The agent creates the native scaffold, generates the source app, and connects
-the copied host entry. You choose the project location and toolkit package.
-For a non-Azure example, ask for the counter starter.
+Ask your agent to **Build a read-only Azure canvas that lists resource
+groups. Use the native create-canvas skill and the create-canvas-app
+companion's Azure starter.** Choose a compatible toolkit package and project
+location when prompted. For a non-Azure example, ask for the counter starter.
 
 ## What you can do
 
 - Generate a native canvas scaffold with a working counter starter.
-- Start a read-only Azure resource-group viewer with explicit subscription
-  choice.
-- Build and smoke-test the generated app before installing its complete
-  output.
+- Start a read-only Azure resource-group viewer with explicit subscription choice.
+- Build and smoke-test the generated app before installing its complete output.
 
 ## Prompts to try
 
-```text
-Use the native create-canvas skill and the create-canvas-app companion to build a counter canvas.
-```
+> Use the native create-canvas skill and the create-canvas-app companion to build a counter canvas.
 
-```text
-Build a read-only Azure canvas that lists resource groups. Use the native create-canvas skill and the create-canvas-app companion's Azure starter.
-```
+> Build a read-only Azure canvas that lists resource groups. Use the native create-canvas skill and the create-canvas-app companion's Azure starter.
 
-```text
-Use the create-canvas-app companion to help me choose a compatible toolkit version before creating files.
-```
+## Requirements
+
+- A canvas-capable GitHub Copilot host with its installed `create-canvas` skill.
+  The plugin does not replace or install that host skill.
+- Node.js 22+ (24 recommended) and npm.
+- The exact `@microsoft/canvas-toolkit@0.1.0-preview.2` release exporting
+  `@microsoft/canvas-toolkit/build`, once published, or an approved local
+  `.tgz` containing that API. Do not treat a missing `/build` export as success.
+- For live Azure reads: Azure CLI 2.61+ and permission to read the subscription.
+
+## Usage data
+
+The plugin counts how often its `create-canvas-app` skill is invoked. Each
+count records the skill name, how it was invoked, the plugin name and version,
+and a timestamp. Usage telemetry may include a pseudonymous account identifier
+to understand usage over time; it is retained for up to 30 days. The plugin
+does not send prompts, project files or source code.
+
+## Create an app
+
+The agent creates the native scaffold, generates the source app, and connects
+the copied host entry. You choose the project location and toolkit package.
 
 Setup accepts one exact npm version or one local tarball. It does not install
 dependencies or contact Azure, and it refuses existing output directories

plugins/canvas-authoring/plugin.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "canvas-authoring",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "A toolkit setup companion to the GitHub Copilot app's installed create-canvas skill, with an Azure starter, safe asset packaging and a focused browser smoke."
 }

plugins/canvas-authoring/skills/create-canvas-app/references/toolkit/README.md

@@ -270,6 +270,52 @@ fields. The public service may add a server-derived GitHub user key; no raw ID
 is persisted and lower-level/custom collectors add no identity unless their
 caller explicitly configures an identity resolver.
 
+### Skill use and workflow completion
+
+The shared skill API is independent of any canvas product. A product defines a
+`SkillUsageContract`: plugin name, host, versions, skill names, and reviewed
+workflow-to-canvas mappings. Register the same contract in the gateway before
+collection. Other canvases do not need to change.
+
+```js
+import { createPublicSkillUsageMetrics } from "@microsoft/canvas-toolkit/telemetry";
+import { createSkillUsageObserver } from "@microsoft/canvas-toolkit/skill-telemetry";
+
+const metrics = createPublicSkillUsageMetrics({
+    contract: PRODUCT_SKILL_USAGE_CONTRACT, pluginVersion: PRODUCT_VERSION,
+});
+const observer = createSkillUsageObserver({
+    contract: PRODUCT_SKILL_USAGE_CONTRACT, metrics,
+    // Optional exact local SKILL.md paths for development-mode reads.
+    skillPaths: registeredSkillPaths,
+});
+const unsubscribe = session.on(event => observer.observe(event));
+
+// Use the controller's local run key. It never leaves the observer.
+observer.beginWorkflow(localRunKey, "registered_action");
+// Call only after the controller accepts the terminal report.
+observer.completeWorkflow(localRunKey, "succeeded");
+// At shutdown: unsubscribe(); observer.dispose(); await metrics.close();
+```
+
+`skill_invoked` records live `skill.invoked` events or successful reads of exact
+registered skill files. Catalog loading and prompt text do not count. Do not
+replay session history. `skill_workflow_completed` records the outcome, duration,
+and skills observed during one active workflow. Empty skill lists are valid.
+Context loads, subagent events, and events with ambiguous workflow ownership
+have no workflow association. A fresh UUID joins these two events; it is not a
+session, device, or controller ID. Paths, event content, and local run keys stay
+local. Association does not prove that a skill caused a better result.
+
+Skill collection uses its own bounded queue and the existing delivery limits.
+An older gateway can reject skill batches without dropping legacy canvas
+batches. Neither collector waits in the action path. Failure produces a fixed
+diagnostic, not a panel error or retry loop. Data stays in process memory; lost
+events are not restored. Use `createSkillUsageMetrics` for a caller-owned policy
+or custom transport, with the same default-off behavior as the canvas API.
+
+### Canvas action instrumentation
+
 `usageClass` distinguishes `intentional` actions from `automatic` background
 work; `excluded` actions produce no events. The wrappers preserve results and
 original exceptions, receivers and arguments. Resolved `ok: false` or
@@ -736,6 +782,7 @@ picker.open({ confirmDefault: true });
 | `triggerVariant` | `"toolbar"` (default icon pill and Change segment) or `"field"` (full-width, single-outline field with a leading icon and trailing chevron) |
 | `mount` | Optional dialog container; defaults to `document.body` |
 | `selectionMode` | `"multiple"` (checkboxes, default) or `"single"` (native radios) |
+| `commitMode` | `"explicit"` (default Apply/Cancel) or opt-in `"immediate"` (row/checkbox and keyboard changes call `onApply` without Apply; Done closes multi-selection) |
 | `singleGroup` | Defaults to `false`; when true, selected items must share a case-insensitive `tenantId` and exact `cloud` |
 | `onApply(items)` | Required callback receiving snapshots of selected item objects; may return a promise |
 | `onRefresh()` | Optional async callback enabling a Refresh subscriptions button inside the picker; update candidates with `setState` and reject on failure |
@@ -752,6 +799,15 @@ This changes only the trigger, not the dialog size, selection model, search,
 keyboard interaction or confirmation behavior. The existing toolbar variant
 remains the default.
 
+Use `commitMode: "immediate"` only when the consumer supports explicit empty
+multi-selection and updates scope without a second confirmation. The Azure-backed
+wrapper forwards this option and sends an empty scope when the final subscription
+is deselected; it never substitutes a default subscription. Pending changes show
+an updating status, serialize `onApply` calls and coalesce rapid changes to the
+latest selection. A failed final change restores the last acknowledged scope and
+shows the error. Done does not undo acknowledged changes. Other consumers retain
+the default explicit commit behavior.
+
 Each subscription has required string `key`, `id`, `name`, and `tenantId` fields.
 Optional fields are `tenantName`, `cloud`, `isDefault`, `disabled`, and
 `disabledReason`. `key` must be unique and nonempty. Keys are never normalized or